Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-64657Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

High 8.4

In plain English

A high-severity SQL injection in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	budibase	3.39.19	GHSA-qqf5-x7mj-v43p

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.39.19

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p x_refsource_CONFIRM
https://github.com/Budibase/budibase/commit/67572a82c3850964f388bfd969779dc025a80224 x_refsource_MISC